ESP32 + Termux + USB OTG

A wireless toolkit
without root.

NRSuite turns a $3 ESP32 into a wireless research toolkit for Termux. Wi-Fi capture and injection, beacon spam, captive portal, BLE HID, BadUSB, and mass storage — no rooted phone, no custom kernel, no expensive hardware.

Get started View on GitHub
Termux — nrsuite
~$3 Hardware cost
0 Root required
13 Wi-Fi channels
Any. Android phone

Capabilities

What it does today

The ESP32 handles everything at the radio layer. The firmware and bridge protocol are modular — new backends register their own commands without touching the transport. Termux talks over USB CDC — no root, no kernel modules, no custom ROM.

scan
Wi-Fi network scan
Active scan returning SSID, BSSID, channel, RSSI, and security type for all visible networks.
capture
Packet capture
Fixed channel or channel-hopping promiscuous capture. Output as .pcap with radiotap headers — Wireshark-compatible.
eapol
Handshake capture
Passive EAPOL capture, optionally filtered by BSSID. No association required — fully passive.
deauth
Deauth + capture
Send deauthentication frames standalone, or combined with sniffing to trigger and capture a handshake.
beacon
Beacon broadcasting
Beacon spam with custom or hidden SSIDs (up to 32), fixed channel, optional stable or random BSSIDs. Runs until Ctrl+C.
portal
Captive portal / AP mode
Start/stop/status, custom SSID and channel, HTML upload, optional auto EAPOL capture against a target BSSID.
ble
BLE HID (BadBLE + keyboard)
Advertise as a BLE keyboard, run DuckyScript payloads, or type live keystrokes from Termux to a paired host.
usb
Mass storage + BadUSB
Expose onboard flash as a USB drive, or arm a DuckyScript payload over native USB HID (S2/S3 USB-OTG).
device
Multi-device select
nrsuite devices lists boards; -d picks by index or path. Auto-detects when only one is plugged in.
live
Live streaming
Pipe pcap output to termshark via named FIFO for real-time frame analysis on the phone itself.
protocol
Modular bridge protocol
Compact framed protocol with flow control over USB CDC bulk transfer — shared transport for every module.

Setup

Up and running in minutes

Works on any stock Android phone with a USB OTG port. No root. No custom ROM. No kernel modules — the same setup carries forward as new radio modules ship.

01
Install Termux dependencies
Install Termux from F-Droid, then add the Termux:API companion app. Run pkg install python termux-api libusb and pip install pyusb.
02
Flash the ESP32 firmware
Build with PlatformIO or grab a pre-built binary from the Releases page. Flash to an ESP32-C3 SuperMini — the primary tested board.
03
Connect via OTG and run
Plug the ESP32 into your phone with a data-capable OTG cable. Grant the USB permission dialog on first use. Run ./nrsuite scan.
# Clone the repo git clone https://github.com/7wp81x/nrsuite cd nrsuite # Install Termux deps pkg install python termux-api libusb pip install pyusb # Flash firmware (PlatformIO) cd firmware/ pio run -e esp32-c3-supermini --target upload cd .. # Make executable and scan chmod +x nrsuite ./nrsuite scan # Multiple boards? List and pick: ./nrsuite devices ./nrsuite -d 0 scan

Or use the automated installer:
curl -sSL https://raw.githubusercontent.com/7wp81x/nrsuite/main/install.sh | bash

Hardware

What you need

C3 / S3 / S2 use native USB (CDC or OTG) and appear as 303A:xxxx. Classic ESP32 devkits work via an external USB-UART bridge (CP2102/CH340/…).

Tested
ESP32-C3 SuperMini
Primary target. ~$3 on AliExpress. Native USB CDC built-in. VID:PID 303A:1001. Single-core RISC-V, 400 KB SRAM.
Tested
ESP32-S3
More RAM and flash, native USB CDC, dual-core Xtensa. Confirmed working — a solid pick for future modules that need extra headroom.
Tested
ESP32-S2
Single-core, native USB-OTG (VID:PID 303A:0002). WiFi, mass storage, and BadUSB tested. No BLE radio — BadBLE/keyboard unavailable on this chip.
Required
USB OTG cable + Android phone
Any Android phone with USB host support. Use a data-capable OTG cable — charge-only cables will not work. No root required.

Bridge Protocol

A compact binary frame, not serial ASCII

Termux and the ESP32 talk over USB CDC bulk transfer using a fixed binary frame with sliding-window flow control — fast enough for live pcap streaming.

Sync0xAD 0xDE
Type1B
ID1B
Length4B LE
PayloadN bytes
Type Direction Payload
CMD 0x01 Termux → ESP32 JSON command + args
RESP 0x02 ESP32 → Termux JSON response, matched by ID
EVENT 0x03 ESP32 → Termux Async JSON — scan results, heartbeat
PCAP 0x04 ESP32 → Termux Raw radiotap header + 802.11 frame
ACK 0x05 Termux → ESP32 Chunk acknowledgment — flow control

Roadmap

What's next

Wi-Fi, portal, beacon spam, BLE HID, BadUSB, and mass storage have shipped. The CMD dispatcher and bridge protocol keep growing — BLE scan/spam and hardware add-ons are next.

AP Mode — captive portal supportShipped
Beacon Broadcasting — custom / hidden SSIDs, continuous TXShipped
BLE HID — BadBLE DuckyScript + live keyboardShipped
USB Mass Storage + BadUSB (S2 / S3)Shipped
Multi-device select — devices list + -d / --deviceShipped
Bluetooth — BLE scanning, advertising, device discovery, BLE spamNext
Hardware expansion — IR, NRF24, CC1101 modules

Comparison

How it stacks up

The no-root path is the unique capability. It turns any stock Android phone into a wireless research platform with zero setup beyond Termux and a $5 chip — one that keeps growing as new radio modules ship.

NRSuite (no root) NRSuite (root) NetHunter + ext. adapter
Root required No Yes Yes
Custom kernel / ROM No No Yes
Hardware cost ~$5 ~$5 $150–400+
Supported Android devices Any Any NetHunter-supported only
Monitor mode Yes Yes Yes
Packet injection Yes Yes Yes
Live Wireshark via FIFO Yes Yes Yes
IR / RF expansion Planned Planned No